chore(deps): update module github.com/xdg-go/scram to v1.2.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/xdg-go/scram	v1.1.2 -> v1.2.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

xdg-go/scram (github.com/xdg-go/scram)

v1.2.0

Compare Source

Added

• Channel binding support for SCRAM-PLUS variants (RFC 5929, RFC 9266)
• GetStoredCredentialsWithError() method that returns errors from PBKDF2
  key derivation instead of panicking.
• Support for Go 1.24+ stdlib crypto/pbkdf2 package, which provides
  FIPS 140-3 compliance when using SHA-256 or SHA-512 hash functions.

Changed

• Minimum Go version bumped from 1.11 to 1.18.
• Migrated from github.com/xdg-go/pbkdf2 to stdlib crypto/pbkdf2 on
  Go 1.24+. Legacy Go versions (<1.24) continue using the external
  library via build tags for backward compatibility.
• Internal error handling improved for PBKDF2 key derivation failures.

Deprecated

• GetStoredCredentials() is deprecated in favor of
  GetStoredCredentialsWithError(). The old method panics on PBKDF2
  errors to maintain backward compatibility but will be removed in a
  future major version.

Notes

• FIPS 140-3 compliance is available on Go 1.24+ when using SCRAM-SHA-256
  or SCRAM-SHA-512 with appropriate salt lengths (≥16 bytes). SCRAM-SHA-1
  is not FIPS-approved.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.